Overview
This report assesses AWS resources against 38 enabled configuration checks across the areas below. It identifies passed and failed checks, unavailable evidence, and affected resources so you can prioritize configuration changes and investigate operational gaps.
CloudFront Logging
- CloudFront Distribution has Access Logging Enabled
- CloudFront Distribution Real-Time Logging Enabled
CloudFront WAF Protection
- CloudFront Distribution is Protected by AWS WAF
CloudFront TLS and HTTPS
- CloudFront Distribution does not Use Deprecated SSL protocols
- CloudFront Security Policy Check
- CloudFront SNI Enabled Check
CloudFront Field-Level Encryption
- CloudFront Distribution has Field-Level Encryption Enabled
CloudFront Origins
- CloudFront Origin Failover Check
- CloudFront Traffic to Origin Encrypted Check
CloudFront Signed URLs and Cookies
- CloudFront distributions should use trusted key groups for signed URLs and cookies
WAF Logging
- WAF WebACL Logging Enabled
- WAFv2 Rule Group Logging Enabled
WAF Rule Groups
- WAFv2 Rule Group Content Check
- WAF Classic Rule Group Contains Rule(s)
WAF Web ACLs
WAF Classic Web ACLs
- WAF Classic WebACLs Found
WAF Resource Associations
- WAF Classic (Global/CloudFront) Rule Has Condition(s) Attached
- WAF Classic (Regional) Rule Has Condition(s) Attached
- WAF Classic (Regional) Web ACL Has Rule(s) Attached
- WAF Classic Web ACL Associated to a Resource
- WAF Classic Web ACL Has Rule(s) Attached
API Gateway REST APIs
- API Gateway Stage Protected by AWS WAF
API Gateway Custom Domains
- API Gateway domain names should use recommended security policies
AppSync GraphQL APIs
Route 53 Hosted Zones
- Route53 Public Zones Logging Enabled
Route 53 DNS Firewall
- Route53 DNS Firewall Mutation Protection Enabled
Route 53 Domains
- Route 53 domains auto renew should be enabled
- Route 53 domains should not expire within next 30 days
- Route 53 domains should not be expired
- Route53 domains privacy protection should be enabled
- Route 53 domains should have transfer lock enabled
SES Identities
- No Publicly Accessible SES Identities
SES Configuration Sets
- SES configuration sets should have TLS enabled for sending emails
ACM Certificates
- Imported and ACM-issued certificates should be renewed within 30 days of expiration
- ACM certificates have Certificate Transparency Logging Enabled
- ACM Certificates Have No Pending Validation
- ACM Certificates Not in FAILED State
- Check RSA Certificate Key Length Compliance
The report includes actionable findings and remediation guidance for supported checks.